mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
remove unnecessary error wrap
This commit is contained in:
parent
f2dacb5752
commit
33a7b2b603
@ -95,7 +95,7 @@ type Runner interface {
|
|||||||
1. Pre-fork container to run programs inside
|
1. Pre-fork container to run programs inside
|
||||||
2. Unix socket to pass fd inside / outside
|
2. Unix socket to pass fd inside / outside
|
||||||
|
|
||||||
Container / Master Communication Protocol (single thread):
|
Container / Host Communication Protocol (single thread):
|
||||||
|
|
||||||
- ping (alive check):
|
- ping (alive check):
|
||||||
- reply: pong
|
- reply: pong
|
||||||
|
|||||||
@ -45,11 +45,11 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg *unixsocket.Msg) error
|
|||||||
},
|
},
|
||||||
}
|
}
|
||||||
if err := c.sendReply(&reply{}, msg); err != nil {
|
if err := c.sendReply(&reply{}, msg); err != nil {
|
||||||
return fmt.Errorf("syncFunc: sendReply %w", err)
|
return fmt.Errorf("syncFunc: sendReply %v", err)
|
||||||
}
|
}
|
||||||
cmd, _, err := c.recvCmd()
|
cmd, _, err := c.recvCmd()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return fmt.Errorf("syncFunc: recvCmd %w", err)
|
return fmt.Errorf("syncFunc: recvCmd %v", err)
|
||||||
}
|
}
|
||||||
if cmd.Cmd == cmdKill {
|
if cmd.Cmd == cmdKill {
|
||||||
return fmt.Errorf("syncFunc: received kill")
|
return fmt.Errorf("syncFunc: received kill")
|
||||||
|
|||||||
@ -49,7 +49,7 @@ func Init() (err error) {
|
|||||||
const defaultFd = 3
|
const defaultFd = 3
|
||||||
soc, err := unixsocket.NewSocket(defaultFd)
|
soc, err := unixsocket.NewSocket(defaultFd)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return fmt.Errorf("container_init: failed to new socket %w", err)
|
return fmt.Errorf("container_init: failed to new socket %v", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
// serve forever
|
// serve forever
|
||||||
@ -61,10 +61,10 @@ func (c *containerServer) serve() error {
|
|||||||
for {
|
for {
|
||||||
cmd, msg, err := c.recvCmd()
|
cmd, msg, err := c.recvCmd()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return fmt.Errorf("serve: recvCmd %w", err)
|
return fmt.Errorf("serve: recvCmd %v", err)
|
||||||
}
|
}
|
||||||
if err := c.handleCmd(cmd, msg); err != nil {
|
if err := c.handleCmd(cmd, msg); err != nil {
|
||||||
return fmt.Errorf("serve: failed to execute cmd %w", err)
|
return fmt.Errorf("serve: failed to execute cmd %v", err)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@ -76,7 +76,7 @@ func (b *Builder) Build() (Environment, error) {
|
|||||||
WithTmpfs("w", ""). // work dir
|
WithTmpfs("w", ""). // work dir
|
||||||
WithTmpfs("tmp", ""). // tmp
|
WithTmpfs("tmp", ""). // tmp
|
||||||
Build(true); err != nil {
|
Build(true); err != nil {
|
||||||
return nil, fmt.Errorf("container: failed to build rootfs mount %w", err)
|
return nil, fmt.Errorf("container: failed to build rootfs mount %v", err)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -84,14 +84,14 @@ func (b *Builder) Build() (Environment, error) {
|
|||||||
root := b.Root
|
root := b.Root
|
||||||
if root == "" {
|
if root == "" {
|
||||||
if root, err = os.Getwd(); err != nil {
|
if root, err = os.Getwd(); err != nil {
|
||||||
return nil, fmt.Errorf("container: failed to get work directory %w", err)
|
return nil, fmt.Errorf("container: failed to get work directory %v", err)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// prepare stdin / stdout / stderr
|
// prepare stdin / stdout / stderr
|
||||||
devNull, err := os.OpenFile(os.DevNull, os.O_RDWR, os.ModePerm)
|
devNull, err := os.OpenFile(os.DevNull, os.O_RDWR, os.ModePerm)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("container: failed to open devNull %w", err)
|
return nil, fmt.Errorf("container: failed to open devNull %v", err)
|
||||||
}
|
}
|
||||||
defer devNull.Close()
|
defer devNull.Close()
|
||||||
|
|
||||||
@ -106,21 +106,21 @@ func (b *Builder) Build() (Environment, error) {
|
|||||||
// prepare container exec file
|
// prepare container exec file
|
||||||
execFile, err := b.exec()
|
execFile, err := b.exec()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("container: prepare exec %w", err)
|
return nil, fmt.Errorf("container: prepare exec %v", err)
|
||||||
}
|
}
|
||||||
defer execFile.Close()
|
defer execFile.Close()
|
||||||
|
|
||||||
// prepare host <-> container unix socket
|
// prepare host <-> container unix socket
|
||||||
ins, outs, err := newPassCredSocketPair()
|
ins, outs, err := newPassCredSocketPair()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("container: failed to create socket: %w", err)
|
return nil, fmt.Errorf("container: failed to create socket: %v", err)
|
||||||
}
|
}
|
||||||
defer outs.Close()
|
defer outs.Close()
|
||||||
|
|
||||||
outf, err := outs.File()
|
outf, err := outs.File()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
ins.Close()
|
ins.Close()
|
||||||
return nil, fmt.Errorf("container: failed to dup container socket fd %w", err)
|
return nil, fmt.Errorf("container: failed to dup container socket fd %v", err)
|
||||||
}
|
}
|
||||||
defer outf.Close()
|
defer outf.Close()
|
||||||
|
|
||||||
@ -149,7 +149,7 @@ func (b *Builder) Build() (Environment, error) {
|
|||||||
pid, err := r.Start()
|
pid, err := r.Start()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
ins.Close()
|
ins.Close()
|
||||||
return nil, fmt.Errorf("container: failed to start container %w", err)
|
return nil, fmt.Errorf("container: failed to start container %v", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
c := &container{
|
c := &container{
|
||||||
|
|||||||
@ -32,7 +32,7 @@ func (s *socket) RecvMsg(e interface{}) (*unixsocket.Msg, error) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
if err := gob.NewDecoder(bytes.NewReader(buff[:n])).Decode(e); err != nil {
|
if err := gob.NewDecoder(bytes.NewReader(buff[:n])).Decode(e); err != nil {
|
||||||
return nil, fmt.Errorf("RecvMsg: failed to decode %w", err)
|
return nil, fmt.Errorf("RecvMsg: failed to decode %v", err)
|
||||||
}
|
}
|
||||||
return msg, nil
|
return msg, nil
|
||||||
}
|
}
|
||||||
@ -46,11 +46,11 @@ func (s *socket) SendMsg(e interface{}, msg *unixsocket.Msg) error {
|
|||||||
// use buf pool to reduce allocation
|
// use buf pool to reduce allocation
|
||||||
buff := bytes.NewBuffer(buf[:0])
|
buff := bytes.NewBuffer(buf[:0])
|
||||||
if err := gob.NewEncoder(buff).Encode(e); err != nil {
|
if err := gob.NewEncoder(buff).Encode(e); err != nil {
|
||||||
return fmt.Errorf("SendMsg: failed to encode %w", err)
|
return fmt.Errorf("SendMsg: failed to encode %v", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
if err := soc.SendMsg(buff.Bytes(), msg); err != nil {
|
if err := soc.SendMsg(buff.Bytes(), msg); err != nil {
|
||||||
return fmt.Errorf("SendMsg: failed to SendMsg %w", err)
|
return fmt.Errorf("SendMsg: failed to SendMsg %v", err)
|
||||||
}
|
}
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|||||||
2
go.mod
2
go.mod
@ -4,5 +4,5 @@ go 1.13
|
|||||||
|
|
||||||
require (
|
require (
|
||||||
github.com/seccomp/libseccomp-golang v0.9.1
|
github.com/seccomp/libseccomp-golang v0.9.1
|
||||||
golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5
|
golang.org/x/sys v0.0.0-20200219091948-cb0a6d8edb6c
|
||||||
)
|
)
|
||||||
|
|||||||
4
go.sum
4
go.sum
@ -1,4 +1,4 @@
|
|||||||
github.com/seccomp/libseccomp-golang v0.9.1 h1:NJjM5DNFOs0s3kYE1WUOr6G8V97sdt46rlXTMfXGWBo=
|
github.com/seccomp/libseccomp-golang v0.9.1 h1:NJjM5DNFOs0s3kYE1WUOr6G8V97sdt46rlXTMfXGWBo=
|
||||||
github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
|
github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
|
||||||
golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5 h1:LfCXLvNmTYH9kEmVgqbnsWfruoXZIrh4YBgqVHtDvw0=
|
golang.org/x/sys v0.0.0-20200219091948-cb0a6d8edb6c h1:jceGD5YNJGgGMkJz79agzOln1K9TaZUjv5ird16qniQ=
|
||||||
golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
golang.org/x/sys v0.0.0-20200219091948-cb0a6d8edb6c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
|||||||
@ -1,10 +1,3 @@
|
|||||||
// Package cgroup provices basic resource control over cgroups
|
|
||||||
// it measure
|
|
||||||
// cpu: cpuacct.usage (ns)
|
|
||||||
// memory: memory.max_usage_in_bytes
|
|
||||||
// it limits:
|
|
||||||
// memory: memory.limit_in_bytes
|
|
||||||
// # of tasks: pids.max
|
|
||||||
package cgroup
|
package cgroup
|
||||||
|
|
||||||
import "os"
|
import "os"
|
||||||
|
|||||||
@ -17,7 +17,7 @@ const roSeal = unix.F_SEAL_SEAL | unix.F_SEAL_SHRINK | unix.F_SEAL_GROW | unix.F
|
|||||||
func New(name string) (*os.File, error) {
|
func New(name string) (*os.File, error) {
|
||||||
fd, err := unix.MemfdCreate(name, createFlag)
|
fd, err := unix.MemfdCreate(name, createFlag)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("memfd: memfd_create failed %w", err)
|
return nil, fmt.Errorf("memfd: memfd_create failed %v", err)
|
||||||
}
|
}
|
||||||
file := os.NewFile(uintptr(fd), name)
|
file := os.NewFile(uintptr(fd), name)
|
||||||
if file == nil {
|
if file == nil {
|
||||||
@ -31,21 +31,21 @@ func New(name string) (*os.File, error) {
|
|||||||
func DupToMemfd(name string, reader io.Reader) (*os.File, error) {
|
func DupToMemfd(name string, reader io.Reader) (*os.File, error) {
|
||||||
file, err := New(name)
|
file, err := New(name)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("DupToMemfd: %w", err)
|
return nil, fmt.Errorf("DupToMemfd: %v", err)
|
||||||
}
|
}
|
||||||
// linux syscall sendfile might be more efficient here if reader is a file
|
// linux syscall sendfile might be more efficient here if reader is a file
|
||||||
if _, err = io.Copy(file, reader); err != nil {
|
if _, err = io.Copy(file, reader); err != nil {
|
||||||
file.Close()
|
file.Close()
|
||||||
return nil, fmt.Errorf("DupToMemfd: io.Copy %w", err)
|
return nil, fmt.Errorf("DupToMemfd: io.Copy %v", err)
|
||||||
}
|
}
|
||||||
// make memfd readonly
|
// make memfd readonly
|
||||||
if _, err = unix.FcntlInt(file.Fd(), unix.F_ADD_SEALS, roSeal); err != nil {
|
if _, err = unix.FcntlInt(file.Fd(), unix.F_ADD_SEALS, roSeal); err != nil {
|
||||||
file.Close()
|
file.Close()
|
||||||
return nil, fmt.Errorf("DupToMemfd: memfd seal %w", err)
|
return nil, fmt.Errorf("DupToMemfd: memfd seal %v", err)
|
||||||
}
|
}
|
||||||
if _, err := file.Seek(0, 0); err != nil {
|
if _, err := file.Seek(0, 0); err != nil {
|
||||||
file.Close()
|
file.Close()
|
||||||
return nil, fmt.Errorf("DupToMemfd: file seek %w", err)
|
return nil, fmt.Errorf("DupToMemfd: file seek %v", err)
|
||||||
}
|
}
|
||||||
return file, nil
|
return file, nil
|
||||||
}
|
}
|
||||||
|
|||||||
@ -60,21 +60,21 @@ func NewSocket(fd int) (*Socket, error) {
|
|||||||
func NewSocketPair() (*Socket, *Socket, error) {
|
func NewSocketPair() (*Socket, *Socket, error) {
|
||||||
fd, err := syscall.Socketpair(syscall.AF_LOCAL, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
|
fd, err := syscall.Socketpair(syscall.AF_LOCAL, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, nil, fmt.Errorf("NewSocketPair: failed to call socketpair %w", err)
|
return nil, nil, fmt.Errorf("NewSocketPair: failed to call socketpair %v", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
ins, err := NewSocket(fd[0])
|
ins, err := NewSocket(fd[0])
|
||||||
if err != nil {
|
if err != nil {
|
||||||
syscall.Close(fd[0])
|
syscall.Close(fd[0])
|
||||||
syscall.Close(fd[1])
|
syscall.Close(fd[1])
|
||||||
return nil, nil, fmt.Errorf("NewSocketPair: failed to call NewSocket on sender %w", err)
|
return nil, nil, fmt.Errorf("NewSocketPair: failed to call NewSocket on sender %v", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
outs, err := NewSocket(fd[1])
|
outs, err := NewSocket(fd[1])
|
||||||
if err != nil {
|
if err != nil {
|
||||||
ins.Close()
|
ins.Close()
|
||||||
syscall.Close(fd[1])
|
syscall.Close(fd[1])
|
||||||
return nil, nil, fmt.Errorf("NewSocketPair: failed to call NewSocket receiver %w", err)
|
return nil, nil, fmt.Errorf("NewSocketPair: failed to call NewSocket receiver %v", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
return ins, outs, nil
|
return ins, outs, nil
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user